Sign in

v1

latestOpenAPI 3.1.02026-08-04147764567.0 KB
accessManagement

List grants with filters

Search and list identity grants with advanced filtering. Supports filtering by user, app, entitlement, status, and date ranges via request body filters.

Filtering

The request body is an array of filter objects. Send an empty array ([]) to retrieve all records.

Each filter object has the following fields:

FieldTypeDescription
attributestringThe field to filter on (see Supported attributes below)
operatorstringComparison operator (see Available operators below)
valuesarrayOne or more { "value": <scalar> } objects

Supported attributes

AttributeTypical operatorDescription
statusIS_ANY_OFGrant status bucket (not the raw status). Accepted values: ACTIVE (includes GRANTED and EXTENDED grants), INACTIVE (includes REVOKED and EXPIRED grants), REVOKED (revoked only). See the Status Reference table below.
userIS_ANY_OFNumeric user ID of the grant recipient (the id field from GET /api/v1/users). Pass one or more user IDs to filter grants belonging to specific people.
appIS_ANY_OFApplication ID — the identity resource app the entitlement belongs to (the id field from GET /api/v1/iga/apps). Filters grants to entitlements under a specific app.
entitlementIS_ANY_OFEntitlement ID — the specific entitlement (group, role, license, etc.) the grant was issued for. Use GET /api/v1/iga/entitlements to discover IDs.
entitlement_valueIS_ANY_OFEntitlement value string — filters by the human-readable entitlement value (e.g. the group name or role name) rather than the numeric ID.
granted_atIS_BETWEENGrant creation timestamp. Requires exactly two values: [start, end] (both inclusive). Accepts ISO 8601 format (2024-01-01T00:00:00Z).
expires_atIS_BETWEENGrant expiration timestamp. Same format as granted_at. Use this to find grants expiring within a specific window.
last_login_atIS_BETWEENLast login timestamp for the grant recipient. Same format as granted_at. Useful for identifying unused grants where the user hasn't logged in recently.

Available operators

OperatorMeaning
EQUALSExact match
NOT_EQUALSExclude exact match
IN / IS_ANY_OFMatch any value in the list
IS_NOT_ANY_OFExclude all listed values
IS_BETWEENInclusive range — pass exactly two values: [start, end]
IS_ON_OR_BEFORE / IS_ON_OR_AFTERDate/time boundary comparisons
CONTAINS / TEXT_CONTAINSSubstring or set membership
IS_NULL / IS_NOT_NULLNull checks — values array can be empty
STARTS_WITH / ENDS_WITHString prefix/suffix match

Status Reference

Grants have a raw status and a status bucket used for filtering:

Filter valueRaw statuses includedDescription
ACTIVEGRANTED, EXTENDEDCurrently valid grants
INACTIVEREVOKED, EXPIREDNo longer valid grants
REVOKEDREVOKEDOnly manually or system-revoked grants

Grant types (returned in responses, not used as filter attributes)

TypeDescription
BIRTHRIGHTAutomatically assigned based on user attributes (department, role, etc.)
PREAPPROVEDPre-approved via an access policy — no approval workflow required
APPROVEDGranted after completing an approval workflow

Entitlement types (filter via the entitlements endpoint, not on grants directly)

TypeDescription
GROUPIdentity provider group membership (e.g. Azure AD group, Okta group)
ROLEApplication role assignment
LICENSESoftware license entitlement
REPORepository access
OTHERCustom entitlement type

Provisioning providers (shown in grant responses)

ProviderDescription
OKTAOkta identity provider
AZURE_ADMicrosoft Entra ID (Azure AD)
JUMPCLOUDJumpCloud directory
GOOGLE_WORKSPACEGoogle Workspace
MS_INTUNEMicrosoft Intune device management
MANUALManual provisioning (service request created for IT team)

Example

[
  {
    "attribute": "status",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": "ACTIVE"
      }
    ]
  },
  {
    "attribute": "app",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 42
      }
    ]
  },
  {
    "attribute": "granted_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "user",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      },
      {
        "value": 456
      }
    ]
  }
]
post/api/v1/iga/grants/list

Query parameters

search_keystring
sort_order'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC' | 'NAME_ASC' | 'NAME_DESC' | 'PUBLISHED_DESC' | 'UNPUBLISHED_DESC' | 'EXPIRES_AT_ASC' | 'EXPIRES_AT_DESC' | 'GRANTED_AT_ASC' | 'GRANTED_AT_DESC'
policy_idstring
app_idinteger
pageinteger
per_pageinteger
next_page_tokenstring

Token from previous response to fetch the next page. When provided, takes priority over page and per_page parameters.

idsstring

Comma-separated list of grant IDs to filter by. When provided, returns only grants matching these IDs.

Headers

X-Api-Keystring required
X-Workspace-Idstring

Request body

attributestring
operator'EQUALS' | 'NOT_EQUALS' | 'CONTAINS' | 'NOT_CONTAINS' | 'IN' | 'NOT_IN' | 'GREATER_THAN' | 'LESS_THAN' | 'GREATER_THAN_EQUALS' | 'LESS_THAN_EQUALS' | 'IS_BETWEEN' | 'IS_NULL' | 'IS_NOT_NULL' | 'STARTS_WITH' | 'ENDS_WITH' | 'TEXT_CONTAINS' | 'TEXT_DOES_NOT_CONTAINS' | 'IS_ANY_OF' | 'IS_NOT_ANY_OF' | 'IS_EXACTLY' | 'IS_ON_OR_BEFORE' | 'IS_ON_OR_AFTER' | 'IS_WITHIN'

Response

Successful response

AccessManagementPostapiV1IgaGrantsListResponse200 required

Empty response body